NimScan Port Scanner Execution

SigmaHQ Detections@sigmaHQ

•updated Feb 17, 2025•1•0•19

Detects the execution of NimScan, a port scanning utility. This rule identifies NimScan based on its executable name ('NimScan.exe') and specific IMPHASH values associated with different versions of the tool. Adversaries have been observed using this utility to scan for open ports on remote hosts within compromised environments.